David,
- GRE is a point-to-point protocol. While those using devices that require a single tunnel for each remote gateway wouldn't mind (e.g. Cisco), IPENCAP does not require the host to configure a tunnel for each remote IP address/subnet. (as i recall this setup won't work with AMPRGW)
- GRE would still have to be handled in the same manner (e.g. forwarding '-p 47' instead of '-p 4'). This also have to do this for 6in4, other tunneling, TCP, UDP, etc...as there's a firewall in between. It's not a matter of the protocol, it's a matter of permitting the traffic through the firewall, then NATing it to its Destination.
- KB3VWG